Fix: Replace unsafe eval() with getattr() for cookie attribute extraction

[S1xinch]

Description

Fixes a security vulnerability in the _convert_cookiejar_to_render() method where eval() was used to extract cookie attributes.

Security Impact

• Before: Using eval() to dynamically access attributes (security risk)
• After: Using getattr() for safe attribute extraction
• Risk: Eliminates potential code injection vulnerability

Changes Made

• Replace eval("cookiejar." + key) with getattr(cookiejar, key, None)
• Improve error handling: except: → except Exception:
• Maintains full backward compatibility

Testing

• All 18 existing non-async tests pass
• Direct logic tests verify getattr() works correctly
• No regressions detected
• Backward compatible (no breaking changes)

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have tested the changes locally
• My changes generate no new warnings
• Existing unit tests passed locally with my changes

🤖 Generated with Claude Code

[S1xinch]

Hi maintainers — while preparing this PR I noticed two earlier PRs already proposed the same fixes independently, both still unmerged after months: #610 (eval() → getattr(), Jul 2026) and #611 (bare except: → except Exception:, Aug 2026). This PR combines both.

Combined with 242 open issues and no commits to master since April 2023 (last repo activity April 2024), it looks like this project may no longer be actively maintained.

If that's the case — no worries, requests-html served the community well! In case it's useful, I've started a maintained fork with this fix applied: https://github.com/S1xinch/requests-html. Happy to keep it in sync and keep addressing issues there if there's interest.

If I'm wrong and this is still active, apologies for the noise, and happy to close this however makes sense.